Bug 2041592 (CVE-2022-21682)

Summary:	CVE-2022-21682 flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amigadave, debarshir, klember, saroy, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	flatpak 1.12.3, flatpak 1.10.6	Doc Type:	If docs needed, set a value
Doc Text:	A path traversal vulnerability was found in Flatpak. This happens when flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-03 20:33:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1999742, 2041593, 2042007, 2042008
Bug Blocks:	2041595

Description Guilherme de Almeida Suckevicz 2022-01-17 19:00:31 UTC

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.

Reference:
https://github.com/flatpak/flatpak/security/advisories/GHSA-8ch7-5j3h-g4fx

Comment 1 Guilherme de Almeida Suckevicz 2022-01-17 19:00:46 UTC

Created flatpak tracking bugs for this issue:

Affects: fedora-all [bug 2041593]

Comment 5 errata-xmlrpc 2022-11-08 09:12:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7458 https://access.redhat.com/errata/RHSA-2022:7458

Comment 6 Product Security DevOps Team 2022-12-03 20:33:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-21682